HIPAA authorization forms for marketing, testimonials and photos

When marketing needs a patient's written authorization

The rule is in 45 CFR 164.508(a)(3) (opens in a new tab): "a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing." Two exceptions: "A face-to-face communication made by a covered entity to an individual," and "A promotional gift of nominal value provided by the covered entity."

When a third party is paying, the form must say so. The regulation's words: "If the marketing involves financial remuneration … to the covered entity from a third party, the authorization must state that such remuneration is involved." Financial remuneration means "direct or indirect payment from or on behalf of a third party whose product or service is being described" (45 CFR 164.501 (opens in a new tab)).

For a practice, the common triggers are:

• A testimonial video, quote or star rating attributed to a named or recognizable patient
• Before-and-after photos, including cropped ones where a tattoo, birthmark or setting identifies the person
• A case story on your blog or social feed about an identifiable patient
• Any patient content in a campaign sponsored by a manufacturer or vendor

What counts as marketing in the first place, and what doesn't, is covered in our hub on HIPAA marketing rules.

The required core elements of a valid authorization

Under 164.508(c)(1), every authorization must include these six core elements. Use the checklist below as a field-by-field build sheet; it can be copied straight into your form draft.

Two more requirements apply to the document as a whole. Under 164.508(c)(3), "The authorization must be written in plain language." Under 164.508(c)(4), you must give the patient a copy of the signed form. Under 164.508(b)(1), you may add content beyond the required elements as long as it's not inconsistent with them.

The examples in the table are for a fictional practice. Illustrative example only.

The required statements: revocation, conditioning, redisclosure

Section 164.508(c)(2) adds three statements the patient must be told:

1. Revocation. The patient's right to revoke the authorization in writing, the exceptions to that right, and how to revoke. (The form may instead refer to your Notice of Privacy Practices if the notice describes these.)
2. Conditioning. Whether treatment, payment, enrollment or eligibility can be conditioned on signing. For marketing, the answer is that it can't, and the form should say so: "Riverside Orthopedics will not condition my treatment or payment on whether I sign this form."
3. Redisclosure. That information disclosed under the authorization may be redisclosed by the recipient and no longer protected by the Privacy Rule. Once a photo is on Instagram, anyone can repost it.

If a third party pays for the marketing, add the remuneration statement required by 164.508(a)(3)(ii): "Riverside Orthopedics receives payment from [company] in connection with this marketing."

Extra clauses for testimonials, photos and video

The regulation sets the minimum. Testimonials and photos need more detail so the patient knows exactly what they're agreeing to, and so you can prove it later.

• Media: Photos, video, audio, written quote, first name, full name, age, town. Let the patient tick each box.
• Platforms: Website, Google Business Profile, Facebook, Instagram, TikTok, YouTube, paid ads, print, email.
• Paid vs organic: Whether content may be used in paid advertising, not just organic posts.
• Identifiability: Whether the face will be shown, cropped or blurred, and whether the name appears.
• Editing rights: That you may crop, caption, shorten or translate, but not alter results.
• Duration: A specific end date, with a note that content already printed or shared by others can't be recalled.
• Compensation: Whether the patient receives anything (a discount, a gift card). Under the FTC's Endorsement Guides, 16 CFR Part 255 (opens in a new tab), a material connection between endorser and seller must be disclosed.

The FTC rules apply on top of HIPAA. If a patient's result isn't representative, the ad must disclose "the generally expected performance in the depicted circumstances." Read more in our guides to the FTC Endorsement Guides and patient testimonial rules. State law and your medical or dental board may add requirements; aesthetic practices should also read our guide to before-and-after photo consent.

Authorizations that fail: common defects

Section 164.508(b)(2) says an authorization "is not valid" if it has any of these defects:

• Expired: the expiration date has passed or the expiration event has occurred
• Incomplete: any core element or required statement is missing
• Revoked: the patient revoked it in writing
• Improperly compounded: combined with another document in violation of 164.508(b)(3)
• Improperly conditioned: treatment or payment was conditioned on signing, in violation of 164.508(b)(4)
• Known to be false: any material information is known by the practice to be false

The compound rule is the one practices break most easily. Under 164.508(b)(3), "An authorization for use or disclosure of protected health information may not be combined with any other document" except in limited cases. Burying a photo release inside the intake packet or the consent-to-treat form invalidates it. Use a standalone form, offered separately, with no pressure to sign.

Collecting, storing and honoring revocations

Collect it cleanly. Offer the form after care, not as part of check-in, and only once the patient has said yes in conversation. Give them a copy, as 164.508(c)(4) requires.

Store it for at least six years. Section 164.508(b)(6) requires you to "document and retain any signed authorization" under 164.530(j), which sets the period at "six years from the date of its creation or the date when it last was in effect, whichever is later" (45 CFR 164.530 (opens in a new tab)). Keep each signed form with a record of every place the content was used.

Make revocation actionable. A patient "may revoke an authorization provided under this section at any time," in writing. The exception is action already taken in reliance on it, such as brochures already printed. Practically:

1. Log the revocation date.
2. Remove the content from your website, social accounts and active ads within an internal deadline you set, such as five business days.
3. Tell your agency or designer to delete working files.
4. Record what was removed and when.

The same discipline applies to posting patient content on social media, where most revocation requests arrive.

Where Medfy fits. Medfy builds HIPAA-compliant forms into practice websites: submissions go to an access-controlled patient inbox, and patient information is stored in separate, encrypted HIPAA databases in the US or Canada. Medfy does not provide e-signatures or document management, so signed authorizations should live in your EHR or a dedicated consent tool that signs a BAA. Read Medfy's HIPAA safeguards, or start with a free marketing audit to see how your current site handles patient data.

Have your attorney review the final form. This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

Does a patient testimonial need a HIPAA authorization?

Yes, if your practice uses anything that identifies the person as your patient: their name, face, voice, story or a quote attributed to them. That is a use of PHI for marketing, which requires a signed authorization under 45 CFR 164.508(a)(3). A review the patient posted on their own doesn't need one, but reusing it in an ad does. Have your attorney review the form before you rely on it.

Can a patient revoke permission after we post their photo?

Yes. Patients can revoke an authorization at any time in writing. Revocation doesn't undo uses you already made in reliance on it, such as printed brochures already handed out, but you should stop new uses and remove the photo from the website and social accounts you control. Record the date you received the revocation and the date you took content down. Confirm your process with your compliance officer or attorney.

Does a HIPAA authorization have to expire?

It must state an expiration date or an expiration event. 'Two years from signing' or 'at the end of our spring 2027 campaign' both work; a blank expiration line makes the form defective. For marketing content, a fixed date gives you a natural point to ask the patient to renew or retire the content. Your attorney can advise on a sensible term for your specialty and state.

Can the authorization be signed electronically?

The Privacy Rule requires the patient's signature and date but doesn't say it must be ink on paper, and the federal E-SIGN Act says a signature can't be denied legal effect solely because it's electronic. Whether a given e-signature method satisfies your state's rules is a question for your attorney. If you use one, the tool should record who signed and when and keep an unaltered copy.